As Remote Work Becomes the Norm, Security Fight Moves to Cloud, Endpoints

As states and cities look to lifting stay-at-home orders, the increased level of employees working remotely will not disappear. That means many businesses will be moving more of their infrastructure to the cloud and having to deal with the security challenges that come from a hybrid infrastructure, experts said this week.

Almost three-quarters of companies (74%) expect at least 5% or more of their former on-site employees to work from home on a permanent basis, while nearly a quarter of firms are planning to keep at least 20% of their workers out of the office post-pandemic, according to a survey of chief financial officers by market research firm Gartner. 

With remote work comes greater cloud usage. That could be a problem for many companies that have issues with visibility into the security of their cloud components, and that often rely on perimeter and on-premise security software and appliances to keep their systems and data safe, says Michael Sentonas, chief technology officer at security services firm CrowdStrike.

"It's my feeling that after the pandemic has subsided, we are going to see a major shift in the workplace as more businesses turn to remote-friendly cultures," he says. "This shift will cause cloud and SaaS adoption to be more important than ever. The cloud will ultimately secure workloads regardless of where employees are located, which will be critical to secure endpoints now and moving into the future."

Prior to 2020, telecommuting grew slowly despite the benefits of remote work, such as greater worker retention, lower employee stress, and more flexibility in work hours. The coronavirus pandemic changed companies' reliance on on-site workers, with many technology firms now relying almost exclusively on employees working from home.

IBM, like so many other businesses, has moved almost entirely to remote working, with 95% of its current workforce working outside of the company's offices. The move is a reversal from when the company revised its work-from-home policy in 2017, forcing thousands of employees in a variety of positions — from marketing to information technology — to come back to the fold and work from an office in one of six cities.

Yet the company — a major player in the cloud — was far more prepared for the challenge than many companies' IT and information security groups, says John Wheeler, business information security officer (BISO) and vice president of strategy and innovation at IBM. Turning the weeks-long disruption of enforced remote working into a business strategy will require a transformation for many firms, he says.

"Coming out of this, CIOs and CISOs need to embrace the fact that we need to continually be ready for a full remote workforce," he says. "We need to assume we are going to have a resurgence of what we are dealing with today, so we are prepared for it. We don't know what the future will be like over the next 12 months."

In a forthcoming report, CrowdStrike found that 89% of business decision makers are now working from home, a 56% increase from before the COVID-19 pandemic. Six in 10 remote workers are using personal devices to do work, and almost all of those workers believe — naively — that their devices are secure, CrowdStrike's Sentonas says. 

Attackers have focused on targeting remote workers, virtual private networking (VPN) technologies, and collaboration software, such as Zoom, in their attempts to take advantage of companies' now much-more-distributed attack surface area, he says.

"Today's stealthy adversaries are keenly aware of this and have been opportunistic as such, using the increased amount of devices to gain access to corporate networks and data," Sentonas says. "With no sign of attacks slowing down, it's more important now than ever for companies to be vigilant about their security posture and train employees on possible risks to protect and defend against rising threats."

IBM has seen a massive increase in coronavirus-related phishing, spam, and malware attacks, says IBM's Wheeler. Many companies do not have the ability to lock down employees' laptops no matter where they are, he says.

"Effectively overnight, your attack surface increased dramatically because any workforce is now outside any perimeter security that you possibly had within an office space," he says. "So you are totally relying on the security that you have built into the endpoint, the security awareness that you have instilled in the users, and any forced connectivity that you have using a VPN back to your own infrastructure."

Complicating matters will be employees' decisions to use unapproved cloud services for work, so-called shadow IT, and the unique risks that remote privileged users pose to network security. In addition, managing the security operations center remotely also poses significant challenges, Wheeler says. About a third of companies struggle with gaining visibility into the security of their cloud infrastructure, according to the "2019 Cloud Security Report."

"Endpoint security is absolutely critical," he advises. "Second, companies really need to focus on end-user security awareness. Finally, cloud is here to stay. Collaboration tools are here to stay. Your employees are going to be hooked on them, and they are going to allow you to be more productive and things will be done, but attackers will focus on those weak points as well."

Related Content:

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register.